The desktop equivalents of our SENTINEL laptop — hand-built sovereign workstations sold in two configurations. BASTION runs Dasharo Coreboot+Heads on a 14th-gen Intel platform with measured boot, Qubes-OS-certified hardware, and the same identity bundle, YubiKey, Tor stack, and CITADEL licence as our laptop. FORTRESS takes that further: an IBM POWER9 Talos II workstation, the only modern platform auditable to the silicon — no Intel ME, no AMD PSP, blob-free firmware down to CPU microcode. Same team package on both. Built for teams. Minimum order: 5 units.
Your team's threat model dictates which tier fits. We don't push the more expensive one. BASTION is the right answer for the vast majority of operators — it's faster, runs Qubes OS natively, and shares 95% of the security stack. FORTRESS is for teams whose threat model genuinely demands silicon-level auditability, where the cost of unaudited microcode is unacceptable.
A standard pre-built PC ships with three layers of attack surface that exist by default. Both BASTION and FORTRESS close all three — they just close the silicon layer differently. Here's what each closes.
Every modern Intel chip ships with the Management Engine. Every modern AMD chip ships with the Platform Security Processor. Both are closed-source co-processors with ring-3 access to RAM, network, and disk, alive even when the machine is "off". BASTION neutralises Intel ME via HAP. FORTRESS never had one.
UEFI, Boot Guard, vendor firmware: closed code that decides what your hardware is allowed to run before the kernel exists. BASTION replaces it with Dasharo Coreboot + Heads — measured boot to a TPM, integrity attested by your YubiKey on every boot. FORTRESS runs OpenPOWER firmware, every line auditable.
Default Windows / macOS phone home on dozens of channels. Default messaging apps require — and broadcast — your phone number. Both tiers ship with Qubes OS or hardened Linux, no telemetry, and a 9-platform identity bundle with no phone numbers, registered over Tor.
Built around a Qubes-OS-certified mainboard with 14th-gen Intel performance. Every component installed new, the case sealed with tamper-evident screws after a 48-hour burn-in, and Dasharo Coreboot+Heads flashed before the chassis is closed. Identical team package as FORTRESS.
Built on the IBM POWER9 Talos II — the only modern workstation platform with no Intel ME, no AMD PSP, and no closed-source firmware blobs anywhere in the boot chain. CPU microcode itself is published. Every byte from power-on to login prompt is open source. We supply, configure, and integrate the same team package as BASTION onto a fundamentally different security floor.
BASTION ships with Dasharo Coreboot+Heads firmware, the same configuration the Qubes OS team uses in their reference builds. On every boot, Heads measures the firmware, the kernel, the initramfs, and the GRUB config into the TPM. Your YubiKey verifies the resulting hash via HOTP — green LED means clean, red LED means tampered. An evil-maid attack between the tamper-evident screws and the TPM is detectable, not theoretical.
Honest framing: measured boot doesn't make a compromise impossible. It makes it detectable. If someone with physical access opens your tower, removes the BIOS chip, modifies it, and re-seals the case — your YubiKey will refuse to verify on the next boot. Red LED. You stop. You ship the unit back to us. We re-flash and re-attest free under the lifetime reflash policy.
Identical to the SENTINEL laptop bundle: nine privacy-grade platforms, registered over Tor, paid in Monero, never linked to your real identity. None require a phone number. 12-month licences renewable per-seat. Credentials handed over physically on tamper-evident paper at the same session as the workstation.
Every team package includes a 320-page printed binder for desktop operations (longer than the laptop binder because of the additional Qubes/Tor-hosting material), the same content as cryptographically signed PDFs, and an 8-hour live onboarding programme split across two sessions over Element. Written to be operationally useful, not legally defensive.
Daily-use Qubes workflows, qube layout, identity-bundle navigation, YubiKey routine, common tasks.
Per-team session. We help you map your real adversary, real assets, real failure modes for stationary infrastructure.
Lost · seized · compromised · power-cut · raid scenarios. Per-operator orders, in order, on the clock.
Lost YubiKey, forgotten passphrase, hardware failure, drive replacement. What's recoverable, what's gone.
Group key management, shared rooms, voice protocols, file exchange, premises hardening.
Hosting your own .onion services for the team — site, dropbox, SimpleX, Matrix homeserver, vanity addresses.
Per-unit signed manifest. Every binary, every blob, every hash, every config. Proof of what we shipped.
2× 4-hour sessions over Element/CITADEL. First session: install & threat model. Second: hosting & OPSEC.
Same minimum order as the laptop programme: 5 units. Same no-discount policy: every team gets the same per-unit attention. You can mix tiers within a single order — for example, three BASTION units for the analysts and two FORTRESS units for the engineers running infrastructure.
Same terms as the SENTINEL laptop programme. Underwritten by professional indemnity insurance. Backed by SLAs. Written into the contract.
Every unit ships with a CSSLTD-signed manifest listing the SHA-256 of every binary, blob, and configuration file on the system. If any hash on your unit fails to match the attestation, we replace the unit and refund in full.
Each unit is covered by a £10,000 professional indemnity policy. If a security breach is forensically traced to a CSSLTD-introduced flaw — firmware, OS, or comms — the policy pays out to the operator. Underwritten by a Lloyd's syndicate.
Five years on every component, parts and labour, no questions about modification or firmware changes. Out-of-warranty repair continues at parts-cost for the platform's life.
If you suspect compromise, ship the unit to us. We re-flash firmware, re-image the OS, and re-issue the build attestation. Free for the life of the unit.
CSSLTD does not retain operator credentials, key material, or access to provisioned identities after handover. We log no operator activity. We hold no master key, no recovery service, no backdoor.
Tamper-evident packaging with photographed seals, signed-for delivery to the named recipient only. Each unit's serial, build hash, and courier waybill are recorded. Broken seal on arrival = unit replaced on sight.
Default to BASTION. It's faster, cheaper, runs Qubes OS, has wider software compatibility, and shares the same identity bundle, YubiKey, Tor stack, and CITADEL licence as FORTRESS. The only reason to choose FORTRESS is if your threat model genuinely requires silicon-level firmware auditability — i.e. you cannot accept that Intel CPU microcode and FSP blobs are present in BASTION, even though they're hashed and tracked in the build attestation. For journalists, NGOs, lawyers, executives, security researchers, and the vast majority of teams, BASTION is the right answer. FORTRESS exists for a smaller cohort: governments, institutional whistleblowers, certificate authorities, regulated infrastructure operators, and a handful of teams whose adversary is the firmware-attack capability of a major nation-state.
Three reasons: (1) Modern desktop components — i9-14900, 64 GB DDR5 ECC, 4 TB of NVMe, redundant cooling, and a Qubes-certified mainboard — cost substantially more than refurbished T480 components. (2) Dasharo Coreboot+Heads requires per-board firmware engineering and an annual Entry Subscription with 3mdeb (the firmware maintainer), which we pay for on the operator's behalf for 5 years. (3) The 8-hour onboarding programme is twice as long as the laptop's 4-hour session, because Qubes OS has a steeper learning curve than a hardened single-OS setup.
Honest answer: the IBM POWER9 platform is a low-volume product. Raptor Computing Systems' Talos II workstation lists at $11,966.99 USD before any of our team package. The motherboard alone is $2,499 USD. The CPUs are between $375 (4-core) and $2,625 (22-core) each. We use 8-core POWER9 Sforza CPUs as the right balance of cost, performance, and TDP. Add VAT, our build labour, the team package, the £10,000 insurance, and the 12-hour onboarding, and £11,999 ex-VAT is roughly cost-plus-margin — there's less room here than in BASTION. The price reflects the actual cost of an audit-to-silicon platform; if it weren't this expensive, the entire industry would be using POWER9 already.
Honest answer: setting the HAP bit and running me_cleaner reduces Intel ME to a tiny boot stub that handles initial silicon bring-up and then halts. The runtime ME — the part that has ring-3 access and a network stack — is no longer executing. Independent researchers (Positive Technologies, among others) have validated this. Is it the same as not having an ME at all? No. The bring-up stub is still proprietary code. If your threat model requires zero closed-source code anywhere on the silicon, you need FORTRESS. For most threat models, neutralised ME plus measured boot plus tamper-evident sealing is the right trade.
BASTION: yes, but we don't recommend it. The Dasharo firmware supports UEFI Secure Boot and will boot Windows 11. We can ship with a Windows-only configuration if you specifically request it (£0 price difference, but the identity bundle and Tor stack lose some integration). The Heads firmware path requires Linux. FORTRESS: no. Windows does not run on PPC64LE. There is no Windows-on-POWER9. If your team has a hard Windows dependency, FORTRESS is the wrong choice.
The NitroPC Pro 2 (and NovaCustom's similar offerings) are excellent products and we respect them. They use the same Dasharo Coreboot+Heads firmware that BASTION uses, on similar 14th-gen Intel hardware. The differences are: (1) we ship as a complete team package — not just a workstation, but pre-provisioned identities, Tor hosting infrastructure, CITADEL comms, printed team documentation, 8 hours of live onboarding, and £10,000 of compromise insurance per unit. (2) We have a 5-unit minimum and a no-discount policy — we are explicitly built for teams, not individual buyers. (3) Our identity bundle and CITADEL service are CSSLTD-operated infrastructure, not just licences to third-party services. If you're a single buyer who wants the workstation only, NitroPC or NovaCustom may serve you better and cost less. If you're equipping a team and want the whole stack from one vendor, that's what we do.
AMD's Platform Security Processor (PSP) is the equivalent of Intel ME, but cannot be neutralised the way Intel ME can — there is no equivalent of the HAP bit on AMD silicon. Coreboot support for modern AMD platforms is also significantly thinner than Intel. If we built an AMD BASTION, the PSP would still be running closed code we can't audit. We chose Intel for the desktop programme specifically because of HAP. If AMD ships a future platform with operator-controllable PSP behaviour, we'll evaluate it.
The infrastructure is operator-owned — we don't audit what you put on it. But the BASTION/FORTRESS programme is sold to teams operating within the law of their jurisdiction: journalists, security researchers, NGOs, lawyers, doctors, executives in jurisdictions with hostile threat models. We refuse orders that, in our judgement, point at criminal use. We do not ship to jurisdictions where strong encryption itself is restricted by import law.
Same three layers as the SENTINEL laptop programme: (1) The Dasharo firmware (BASTION) or OpenPOWER firmware (FORTRESS) are built from upstream source — we ship the build container, you re-build, the SHA-256 of the resulting image must match your unit's attestation. (2) The OS image is provisioned via a public Ansible manifest. Re-provision a unit yourself and compare every file's hash. (3) On FORTRESS specifically, you can additionally verify CPU microcode against IBM's published source — this is uniquely possible on POWER9 and impossible on any modern Intel/AMD platform.
BASTION: 5–7 weeks from order confirmation. FORTRESS: 8–10 weeks (POWER9 supply-constrained, we order from Raptor when your deposit clears). We ship UK and EU mainland by default — pallet courier for FORTRESS due to weight, signed-for delivery to the named recipient only. For US, CH, IS, NO, and selected APAC: contact us, additional shipping & customs handling fees apply. We do not ship to jurisdictions where strong encryption or operator-controlled hardware is restricted by import law.
A 50% deposit confirms the order. The balance is taken on shipment. Refundable in full any time before flashing begins. We respond to every operator brief within 24 hours, in writing, signed.
orders@cssltd.example · PGP 0x4F2A on request · CITADEL: @ops.cssltd